#!/bin/bash

# 设置文件备份函数
mk_bak() {
    local file_path="${@: -1}"
    if [ -e "${file_path}" ]
    then
        cp -av "${file_path}" "${file_path}.$(date +%F_%s)"
    else
        echo "error not exist file ${file_path}"
        return 1
    fi
}

update_kv() {
    local file_path="${@: -1}"
    local typeset -A kv="${@: -2:1}"
    if [ -e "${file_path}" ]
    then
         for key in ""
    else
        echo "error ! not exist file ${file_path}"
    fi
}

audit_path='/etc/audit/auditd.conf'
typeset -A audit_kv=(
    ['net.ipv6.conf.all.accept_redirects']='0'
    ['net.ipv6.conf.default.accept_redirects']='0'
    ['net.ipv6.conf.all.accept_ra']='0'
    ['net.ipv6.conf.default.accept_ra']='0'
    ['net.ipv4.tcp_syncookies']='1'
    ['net.ipv4.conf.all.rp_filter']='1'
    ['net.ipv4.conf.default.rp_filter']='1'
    ['net.ipv4.conf.all.log_martians']='1'
    ['net.ipv4.conf.default.log_martians']='1'
    ['net.ipv4.conf.all.secure_redirects']='0'
    ['net.ipv4.conf.default.secure_redirects']='0'
    ['net.ipv4.conf.all.accept_redirects']='0'
    ['net.ipv4.conf.default.accept_redirects']='0'
    ['net.ipv4.conf.all.accept_source_route']='0'
    ['net.ipv4.conf.default.accept_source_route']='0'
    ['net.ipv4.conf.all.send_redirects']='0'
    ['net.ipv4.conf.default.send_redirects']='0'
    ['net.ipv4.ip_forward']='0'
)

mk_bak ${audit_path} &&
for key in "${!audit_kv[@]}"
do
    value=${audit_kv[$key]}
    if grep -iP "^\s*${key}" ${audit_path}
    then
        # 注意：此处Ic表示忽略大小写匹配后替换原配置行
        sed -i -r "/^[ \t]*${key} *=/Ic${key} = ${value}" ${audit_path}
    else
        sed -i -r "\$a${key} = ${value}" ${audit_path}
    fi
done


# 到第20行，且26-46行需要本地化